European Parliament adopts the AI Act, 523 to 46

The European Parliament voted 523 in favor, 46 against and 49 abstentions on Wednesday to adopt the AI Act, rubber-stamping the provisional agreement it reached with the Council in December after years of trilogue negotiations. The vote puts the text well on its way to becoming law across the bloc, with only a final Council approval pending.

The law's core is a risk-based framework: the obligations a system carries depend on the risk of its use-case, not on the technology itself. European Commission President Thierry Breton summed up the intended calibration with "regulating as little as possible, but as much as needed."

How the risk ladder works

At the top of the ladder, a handful of use-cases are classified as unacceptable risk and banned outright: social scoring and subliminal manipulation are the ones named. Below that, "high risk" applications, such as AI used in education, employment, or for remote biometric identification, must be registered and their developers must comply with the risk and quality management provisions the law sets out.

Most AI apps land in the low-risk bucket and face no hard rules at all. A third subset carries lighter transparency obligations: chatbots, generative tools that create synthetic media, and general-purpose AI models (GPAI). The most powerful GPAIs, those classified as posing "systemic risk", face additional risk-management requirements.

On enforcement, fines for violating the ban on prohibited uses can reach 7% of global annual turnover (or €35 million, whichever is higher). Breaches of other provisions on AI systems can draw penalties of up to 3% (or €15 million), and failing to cooperate with oversight bodies risks up to 1%.

The GPAI compromise

The GPAI rules are the part of the act that moved the most. They were a later addition, pushed by MEPs concerned that the wave of frontier models driving the generative AI boom would escape regulation entirely. A group of member states, led by France, pushed in the opposite direction, supported by lobbying from homegrown startups like Mistral, arguing that Europe should free its national champions to scale rather than slow them down.

The December compromise split the difference: no full carve-out, but most GPAIs will only face limited transparency requirements. The heavier obligations kick in only for models trained with compute power above 10^25 FLOPs. Asked after the vote whether Mistral's lobbying had weakened the final text, co-rapporteur Brando Benifei said the results "speak for themselves" and that the act "clearly defin[es] the needs for safety of [the] most powerful models with clear criteria." Co-rapporteur Dragoș Tudorache rejected the suggestion that lobbys had shaped the outcome: "we negotiated and we made the compromises that we felt were reasonable to make."

What happens next

The act enters into force 20 days after publication in the EU's Official Journal, which is expected in coming months. Implementation is then phased: the first subset of provisions, the prohibited use-cases, applies after six months, with the rest following at 12, 24 and 36 months. Full implementation is not expected until mid-2027.

Both co-rapporteurs described the act as the start of a longer process: more legislation will follow, including a directive on AI in the workplace, and the EU will need to keep up its own investment in compute and research. Benifei also pointed to environmental reporting requirements added to the text.

If you ship AI to the EU, the practical read is that the classification work starts now: whether your product is a chatbot with disclosure duties, a high-risk system with registration duties, or low-risk software with none, the answer determines your compliance cost, and the six-month clock on the bans starts before most teams will feel the rest.